Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Svyatoslav Pavlov
Which SSH clients support MCP in 2026
A handful of SSH clients and terminals support MCP now, but "support MCP" means three different things, and the difference is what you actually care about: Built-in MCP server — the client exposes your hosts as MCP tools an external agent can call (Conduit, XPipe, VibeShell, Termalin). MCP client — the app's own in-terminal agent can use other MCP servers (Warp). Community bridge or plugin — a third-party add-on exposes the app's sessions (Tabby, MobaXterm, Termius).
SSH into a server behind NAT or CGNAT, without port forwarding
Reach a server with no open port: reverse SSH tunnel, Tailscale or WireGuard, Cloudflare Tunnel, or an outbound connector — with trade-offs and setup. You want to SSH into a machine you can't accept connections to: a home server behind your router, a Raspberry Pi at the office, a box on a mobile or 5G link. The old answer — forward port 22 on the router — increasingly isn't available, and where it is, it's a bad idea.
ssh-agent on Windows: start the service, add your keys, fix the errors
You put a passphrase on your SSH key, and now Windows asks for it on every git push and every ssh. The fix is the SSH agent — unlock the key once, and every connection after that signs silently. The twist on Windows is that there isn't one agent. There are three that can be running at the same time, they hold keys in separate places, and a key loaded into one is invisible to the others. Almost every "it worked yesterday" agent problem on Windows is really a wrong agent problem.
The best SSH client with a built-in MCP server (2026 buying guide)
Five checks for an SSH client with a built-in MCP server: key custody, per-host policy, a hosted endpoint, live oversight, platforms. How Termalin scores. "SSH client with a built-in MCP server" is a young category, and it's easy to be sold the wrong thing. A lot of what ships under that banner is a thin wrapper: an ssh_exec tool with a private key sitting in the wrapper's config.
Connect Google's Gemini CLI to your servers over SSH — safely
Gemini CLI speaks MCP, so it runs commands and manages files on your servers through Termalin — one entry in ~/.gemini/settings.json, no key handed over. Google's Gemini CLI is a capable agent in a terminal, and like the other coding agents it eventually needs to leave your laptop and touch a real server — restart a service, tail a log, run the deploy on the box itself.
Watch many SSH sessions at once — a live grid for humans and agents
tmux and csshX tile your terminals; Termalin's watch grid tiles every open SSH session as a live view and glows the ones an AI agent is driving. Anyone who has run more than a couple of servers knows the failure mode: eight terminal windows, a deploy going out across four of them, and no single place to see whether it's working. The old answers — tmux panes, csshX, a wall of iTerm splits — tile terminals so you can glance across them.
SSH reverse tunnels (ssh -R): expose a local port through a remote server
How ssh -R works — the listener opens on the remote side. Demoing a dev server, reaching a machine behind NAT, catching webhooks, plus GatewayPorts. You have something running on your laptop — a dev server, an API, a machine at home behind NAT — and something on the other side of the internet needs to reach it. No public IP, no router access, no time to set up a VPN.
How to move files between two servers — without downloading them to your laptop first
scp -3, rsync, the tar-over-ssh pipe, S3 as a relay, and the GUI way: five ways to copy files server-to-server, and when each one wins. You have a 40 GB directory on server A that needs to be on server B. The reflex — download to the laptop, upload to the other box — moves the data twice, hammers your home uplink in both directions, and falls over the moment your Wi-Fi hiccups at gigabyte 32. Every admin eventually collects a better toolkit for this. Here it is, shortest path first. 1.
Per-host command allowlists: least-privilege SSH for AI agents
Holding an agent's key isn't enough — bound what it runs. Per-host command policies (full, allowlist, or blocked) are least-privilege SSH for AI agents. There are two separate questions in giving an AI agent access to a server, and most setups only answer the first. The first is who holds the credential — and getting the key out of the agent's hands, into a custodian that signs on its behalf, is a real and necessary win.
What is the SSH agent, and how does ssh-add work?
The SSH agent unlocks your key once and signs for you so the key never leaves memory. ssh-add, where it lives on each OS, and why the socket needs guarding. Originally published at termal.in. If you've protected your SSH key with a passphrase — and you should have — you've met the annoyance the agent exists to solve: type that passphrase for every single connection, or leave the key unprotected. The SSH agent is the third option.
Let Claude Code and Cursor query your database (safely) — the MCP setup
An agent that can read your database answers questions you'd otherwise open a SQL editor for. "Why did signups drop on Tuesday?" "Which orders have been stuck in pending for more than an hour?" "What's actually in the events table?" With a query capability the model answers in seconds; without one it guesses. The useful part isn't the SQL — Claude Code and Cursor both write SQL fine — it's giving the agent a way to run a read without handing it your credentials.
GitHub / GitLab SSH key not working: the fix, step by step
An SSH key that won't authenticate to GitHub or GitLab is one of the most-Googled developer problems there is, and half the time the key is fine — the diagnosis is just wrong. So before you regenerate anything, run one test and learn to read its answer. Then work the culprits in order of how often they're actually the cause.
ProxyJump: reach servers behind a bastion without copying keys around
Most production networks put a single gateway in front of everything. A bastion, a jump host, a jump box — one machine that accepts SSH from the outside world, with the servers you actually care about sitting on a private network behind it, no public address of their own. The question is how to get through that gateway to the box behind it without making a mess of your keys. The clean answer is ProxyJump.
How to let an AI agent deploy to your server — without handing it your SSH keys
The coding part is mostly solved. An agent can branch, patch, write the tests, open the PR. Then the change has to land on an actual server — a service restarted, a migration run, an nginx config edited — and the autonomy stops cold. Deploying needs SSH, SSH needs credentials, and nobody in their right mind wants to paste a private key into an agent's environment. That hesitation is correct, and it's worth being precise about why.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Svyatoslav
Contact Svyatoslav, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack